Hello all,
I have just released a new library for Ruby:
http://turing.rubyforge.org/
Turing is implementation of Captcha (Completely Automated Public
Turing-Test
to Tell Computers and Humans Apart) that is both easy to use and easy to
customize/extend.
It makes use of the excellent Ruby/GD2 gem released by Robert Leslie.
At this time there are three levels of abstraction you can use:
-
Turing::Image - Simple obfuscated image generator with plugin design.
ti = Turing::Image.new(:width => 280, :height => 115)
ti.generate(File.join(Dir.getwd, ‘a.jpg’), “randomword”)
-
Turing::Challenge: Captcha challenge generator and verifier.
tc = Turing::Challenge.new(:store => ‘store’, :outdir => ‘.’)
c = tc.generate_challenge
system(“xv”, c.file)
puts “Enter solution:”
r = $stdin.gets.chomp
if tc.valid_answer?(c.id, r)
puts “That’s right.”
else
puts “I don’t think so.”
end
-
Turing::CGIHandler: Simple Turing::Challenge wrapper designed to run
as CGI.
tcgi_config = {
:imagepath => “/imgs”,
:outdir => ‘/home/wejn/ap/htdocs/imgs’,
:store => ‘/home/wejn/ap/data/turing.pstore’,
:redirect_to => ‘http://localhost:8000/secured/’,
}
tcgi_config[:on_success] = proc do
out = {}
out[:headers] = {
“cookie” => CGI::Cookie.new({
‘name’ => ‘turing_passed’,
‘value’ => ‘true’,
‘path’ => ‘/’,
‘expires’ => Time.now + 3600*24,
}),
“dude” => “you_rock!”,
}
out
end
Turing::CGIHandler.new(tcgi_config).handle
You can find (r)doc, gem and samples via the site mentioned above.
Rg,
Michal S.
PS: This is my cry for help: I’m looking for volunteer to help me
perform end-user (and performance) test of Apache2 drop-in
replacement
for mod_auth that prevents (among other things)
dictionary/bruteforce
attacks against credentials. If it sounds like fun, please check out
details: http://wejn.org/ta-rt.html
Oh well :-/
Fixed bug in CGIHandler, so version 0.0.8 is out.
Also you can check out demo of CGIHandler here:
http://wejn.org/te/
M.
On Sun, 2005-11-27 at 07:42 +0900, Michal wrote:
Oh well :-/
Fixed bug in CGIHandler, so version 0.0.8 is out.
Hm, you may want to do a 0.0.9… I think your gem was built with Ruby
1.8.3 and thus is experiencing this problem:
http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/161508
Yours,
Tom
Hi,
You can patch rubygems/builder.rb with
http://rubyforge.org/tracker/index.php?func=detail&aid=2885&group_id=126&atid=577
excellent! Thanks!
Just released 0.0.9:
http://rubyforge.org/frs/shownotes.php?release_id=3633
Oh, and I added it to Rakefile so no /usr/lib/ruby/…/rubygems changes
are necessary 
If anyone is interested, the trick is overriding to_yaml method:
def spec.to_yaml
out = super
out = '— ’ + out unless out =~ /^—/
out
end
on Gem::Specification instance 
God bless Ruby’s open classes
Rg,
M.
Hi,
Hm, you may want to do a 0.0.9… I think your gem was built with Ruby
1.8.3 and thus is experiencing this problem:
http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/161508
yeah, it was 
Is this bug fixed in 1.8.4_preview1 ?
Or – is there a way to diagnose/fix the problem for 1.8.3 ?
I would prefer not to downgrade to 1.8.2 if there’s a way.
Rg,
M.
I hope your not using
“cookie” => CGI::Cookie.new({
‘name’ => ‘turing_passed’,
‘value’ => ‘true’,
‘path’ => ‘/’,
‘expires’ => Time.now + 3600*24,
}),
to test if the user is authenticated.
On 27/11/05, Michal [email protected] wrote:
are necessary
Rg,
M.
Michal Safranek, email:
a=((“a”…“z”).to_a+[“@”,“.”]);p((“%b”%[0x645bbb83a6a496]
).scan(/…/).map{|x|a[Integer(“0b”+x)]}.join.reverse)
–
Cheers,
zimba
Can someone show me a code snippet, including require ‘…’ for
deflating a
string with Zlib?
Thanks in advance
John B
Hi,
Can someone show me a code snippet, including require ‘…’
for deflating a string with Zlib?
how about this:
require ‘zlib’
Zlib::Deflate.deflate(“abc”)
=> “x\234KLJ\006\000\002M\001’”
Zlib::Deflate.deflate(“a”*5000)
=>
“x\234\355\3011\001\000\000\000\302\240\254\353_\302\024~@\001\000\000\000\000o\003Kof\362”
Zlib::Inflate.inflate(Zlib::Deflate.deflate(“a”*5000)).size
=> 5000
M.
Excerpt from http://turing.rubyforge.org/classes/Turing/CGIHandler.html
:
Please note: Using this script verbatim is like having no turing
challenge
at all – any non-braindead attacker will get around it in no time.
M.
On Sunday 27 November 2005 17:12, Ross B. wrote:
On Sun, 27 Nov 2005 12:05:35 -0000, Michal [email protected]
wrote:
[…]
Rg,
M.
Amen to that :). I’ve been hit with this same problem I think, so
thanks all from me too
Great! Rant uses this trick now, too.
Thankfully,
Stefan
On Sun, 27 Nov 2005 12:05:35 -0000, Michal [email protected]
wrote:
Oh, and I added it to Rakefile so no /usr/lib/ruby/…/rubygems changes
on Gem::Specification instance God bless Ruby’s open classes
Rg,
M.
Amen to that :). I’ve been hit with this same problem I think, so thanks
all from me too
On Monday 28 November 2005 08:27 am, Tobias L. wrote:
Great work on the library!
On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.
E.g: don’t use captchas, they are evil.
Not really. Captchas which work properly are protection from automation
bots.
I recommend taking some time to explore security and how damage may be
caused
as an effect of not having any protection at all. This is the real world
we
live in, not Pleasantville.
On 11/26/05, Michal [email protected] wrote:
Hello all,
I have just released a new library for Ruby:
http://turing.rubyforge.org/
Great! This is a nice library to have for protecting sites.
Tsume
Quoting T. [email protected]:
Not really. Captchas which work properly are protection from
automation bots.
Indeed. Everybody knows the blind eat old people’s medicine for
fuel.
For many sites, excluding the blind doesn’t constitute “working
properly”.
-mental
Great work on the library!
On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.
E.g: don’t use captchas, they are evil.
Hi,
On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.
well, I’m aware of this issue … I just didn’t need to solve it right
away because the site(s) I’ll be deploying this on are mostly “visual”,
so having seeing disabilities is deal breaker anyway.
I’m willing to implement any reasonable protocol that will help disabled
people to successfully pass this authentication – right now I’m just
a tad confused what it should be? Any good ideas/references?
Rg,
Michal
PS: This is my cry for help again: I’m still looking for volunteer to
help me perform end-user (and performance) test of Apache2 drop-in
replacement for mod_auth that prevents (among other things)
dictionary
(and bruteforce) attacks against credentials. If it sounds like fun,
please check out details: http://wejn.org/ta-rt.html
On Mon, 28 Nov 2005, Michal wrote:
Hi,
On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.
well, I’m aware of this issue … I just didn’t need to solve it right
away because the site(s) I’ll be deploying this on are mostly “visual”,
so having seeing disabilities is deal breaker anyway.
I don’t quite understand this.
You appear to be saying: “It’s OK for my package to discriminate
against blind people, because I’m going to be doing that anyway.”
So I must have misunderstood you, surely?
Hugh
On Mon, 28 Nov 2005, Michal wrote:
Hi,
You appear to be saying: “It’s OK for my package to discriminate
against blind people, because I’m going to be doing that anyway.”
Nah, what I really mean is something like:
I developed this for my Master’s thesis and I expect it to be used
(by me) at servers that have mostly “visual” content, thus I didn’t
have to work on this issue in the first version.
Some consideration of accessibility issues might be a good thing to
write up, even if you don’t have time to address them. [“Audio
description”, “tactile maps”, “Living Paintings Trust” ] is probably
a sufficient list to get you started on accessibility techniques for
visual media.
Since I released it to public, I’m more than willing to make necessary
changes to the code to support other authentication methods – I’m
just not sure what it should be (or how to implement “aural” captcha
for example).
Well, one possiblity is textual only, accessible to deafblind people
as well:
http://www.rubyquiz.com/quiz48.html
I don’t know what your website is for but there has been quite a bit
of work on voice browsers, and that is for sighted people.
http://www.w3.org/Voice/
I’m open to any suggestions and/or patches.
Sounds better?
Rg,
Michal
HTH
Hugh
Hi,
On a semi-ontopic post i’d like to remind that if your page uses
captchas you should offer a alternative way of authenticating like
phone or email because they are also excellent at keeping out blind
people and people with other seeing disabilities.
well, I’m aware of this issue … I just didn’t need to solve it right
away because the site(s) I’ll be deploying this on are mostly “visual”,
so having seeing disabilities is deal breaker anyway.
I don’t quite understand this.
it might be b/c English is not my first language?
You appear to be saying: “It’s OK for my package to discriminate
against blind people, because I’m going to be doing that anyway.”
Nah, what I really mean is something like:
I developed this for my Master’s thesis and I expect it to be used
(by me) at servers that have mostly “visual” content, thus I didn’t
have to work on this issue in the first version.
Since I released it to public, I’m more than willing to make necessary
changes to the code to support other authentication methods – I’m
just not sure what it should be (or how to implement “aural” captcha
for example).
I’m open to any suggestions and/or patches.
Sounds better?
Rg,
Michal
What am i doing wrong? the text being rendered is very very small.
I have posted an example on www.reapfuels.co.uk,
any ideas?
Thank you